这是什么情况阿？ 暴力ssh破密码登入？

herolcb24

Apr 16 12:57:01 herolcb sshd[9691]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:01 herolcb sshd[9692]: Invalid user geo from 222.68.176.236
Apr 16 12:57:01 herolcb sshd[9693]: input_userauth_request: invalid user geo
Apr 16 12:57:01 herolcb sshd[9692]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:01 herolcb sshd[9692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:01 herolcb sshd[9692]: pam_succeed_if(sshd:auth): error retrieving information about user geo
Apr 16 12:57:04 herolcb sshd[9692]: Failed password for invalid user geo from 222.68.176.236 port 14690 ssh2
Apr 16 12:57:04 herolcb sshd[9693]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:04 herolcb sshd[9759]: Invalid user geoffrey from 222.68.176.236
Apr 16 12:57:04 herolcb sshd[9760]: input_userauth_request: invalid user geoffrey
Apr 16 12:57:04 herolcb sshd[9759]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:04 herolcb sshd[9759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:04 herolcb sshd[9759]: pam_succeed_if(sshd:auth): error retrieving information about user geoffrey
Apr 16 12:57:06 herolcb sshd[9759]: Failed password for invalid user geoffrey from 222.68.176.236 port 14968 ssh2
Apr 16 12:57:06 herolcb sshd[9760]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:06 herolcb sshd[9762]: Invalid user george from 222.68.176.236
Apr 16 12:57:06 herolcb sshd[9763]: input_userauth_request: invalid user george
Apr 16 12:57:06 herolcb sshd[9762]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:06 herolcb sshd[9762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:06 herolcb sshd[9762]: pam_succeed_if(sshd:auth): error retrieving information about user george
Apr 16 12:57:09 herolcb sshd[9762]: Failed password for invalid user george from 222.68.176.236 port 15182 ssh2
Apr 16 12:57:09 herolcb sshd[9763]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:09 herolcb sshd[9764]: Invalid user georgia from 222.68.176.236
Apr 16 12:57:09 herolcb sshd[9765]: input_userauth_request: invalid user georgia
Apr 16 12:57:09 herolcb sshd[9764]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:09 herolcb sshd[9764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:09 herolcb sshd[9764]: pam_succeed_if(sshd:auth): error retrieving information about user georgia
Apr 16 12:57:11 herolcb sshd[9764]: Failed password for invalid user georgia from 222.68.176.236 port 15454 ssh2
Apr 16 12:57:11 herolcb sshd[9765]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:11 herolcb sshd[9766]: Invalid user gerald from 222.68.176.236
Apr 16 12:57:11 herolcb sshd[9767]: input_userauth_request: invalid user gerald
Apr 16 12:57:11 herolcb sshd[9766]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:11 herolcb sshd[9766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:11 herolcb sshd[9766]: pam_succeed_if(sshd:auth): error retrieving information about user gerald
Apr 16 12:57:13 herolcb sshd[9766]: Failed password for invalid user gerald from 222.68.176.236 port 15714 ssh2
Apr 16 12:57:13 herolcb sshd[9767]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:13 herolcb sshd[9782]: Invalid user geraldine from 222.68.176.236
Apr 16 12:57:13 herolcb sshd[9783]: input_userauth_request: invalid user geraldine
Apr 16 12:57:13 herolcb sshd[9782]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:13 herolcb sshd[9782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:13 herolcb sshd[9782]: pam_succeed_if(sshd:auth): error retrieving information about user geraldine
Apr 16 12:57:15 herolcb sshd[9782]: Failed password for invalid user geraldine from 222.68.176.236 port 15921 ssh2
Apr 16 12:57:15 herolcb sshd[9783]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:16 herolcb sshd[9848]: Invalid user german from 222.68.176.236
Apr 16 12:57:16 herolcb sshd[9849]: input_userauth_request: invalid user german
Apr 16 12:57:16 herolcb sshd[9848]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:16 herolcb sshd[9848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:16 herolcb sshd[9848]: pam_succeed_if(sshd:auth): error retrieving information about user german
Apr 16 12:57:17 herolcb sshd[9848]: Failed password for invalid user german from 222.68.176.236 port 16157 ssh2
Apr 16 12:57:17 herolcb sshd[9849]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:18 herolcb sshd[9850]: Invalid user gerrard from 222.68.176.236
Apr 16 12:57:18 herolcb sshd[9851]: input_userauth_request: invalid user gerrard
Apr 16 12:57:18 herolcb sshd[9850]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:18 herolcb sshd[9850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:18 herolcb sshd[9850]: pam_succeed_if(sshd:auth): error retrieving information about user gerrard
Apr 16 12:57:20 herolcb sshd[9850]: Failed password for invalid user gerrard from 222.68.176.236 port 16366 ssh2
Apr 16 12:57:20 herolcb sshd[9851]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:20 herolcb sshd[9852]: Invalid user gerry from 222.68.176.236
Apr 16 12:57:20 herolcb sshd[9853]: input_userauth_request: invalid user gerry
Apr 16 12:57:20 herolcb sshd[9852]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:20 herolcb sshd[9852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:20 herolcb sshd[9852]: pam_succeed_if(sshd:auth): error retrieving information about user gerry
Apr 16 12:57:23 herolcb sshd[9852]: Failed password for invalid user gerry from 222.68.176.236 port 16649 ssh2
Apr 16 12:57:23 herolcb sshd[9853]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:23 herolcb sshd[9855]: Invalid user gertrude from 222.68.176.236
Apr 16 12:57:23 herolcb sshd[9856]: input_userauth_request: invalid user gertrude
Apr 16 12:57:23 herolcb sshd[9855]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:23 herolcb sshd[9855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:23 herolcb sshd[9855]: pam_succeed_if(sshd:auth): error retrieving information about user gertrude
Apr 16 12:57:25 herolcb sshd[9855]: Failed password for invalid user gertrude from 222.68.176.236 port 16950 ssh2
Apr 16 12:57:25 herolcb sshd[9856]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:25 herolcb sshd[9922]: Invalid user gia from 222.68.176.236
Apr 16 12:57:25 herolcb sshd[9923]: input_userauth_request: invalid user gia
Apr 16 12:57:25 herolcb sshd[9922]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:25 herolcb sshd[9922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:25 herolcb sshd[9922]: pam_succeed_if(sshd:auth): error retrieving information about user gia
Apr 16 12:57:28 herolcb sshd[9922]: Failed password for invalid user gia from 222.68.176.236 port 17164 ssh2
Apr 16 12:57:28 herolcb sshd[9923]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:28 herolcb sshd[9924]: Invalid user gib from 222.68.176.236
Apr 16 12:57:28 herolcb sshd[9925]: input_userauth_request: invalid user gib
Apr 16 12:57:28 herolcb sshd[9924]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:28 herolcb sshd[9924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:28 herolcb sshd[9924]: pam_succeed_if(sshd:auth): error retrieving information about user gib
Apr 16 12:57:30 herolcb sshd[9924]: Failed password for invalid user gib from 222.68.176.236 port 17466 ssh2
Apr 16 12:57:30 herolcb sshd[9925]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:30 herolcb sshd[9926]: Invalid user gibson from 222.68.176.236
Apr 16 12:57:30 herolcb sshd[9927]: input_userauth_request: invalid user gibson
Apr 16 12:57:30 herolcb sshd[9926]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:30 herolcb sshd[9926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:30 herolcb sshd[9926]: pam_succeed_if(sshd:auth): error retrieving information about user gibson
Apr 16 12:57:32 herolcb sshd[9926]: Failed password for invalid user gibson from 222.68.176.236 port 17675 ssh2
Apr 16 12:57:32 herolcb sshd[9927]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:33 herolcb sshd[9928]: Invalid user gil from 222.68.176.236
Apr 16 12:57:33 herolcb sshd[9929]: input_userauth_request: invalid user gil
Apr 16 12:57:33 herolcb sshd[9928]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:33 herolcb sshd[9928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:33 herolcb sshd[9928]: pam_succeed_if(sshd:auth): error retrieving information about user gil
Apr 16 12:57:34 herolcb sshd[9928]: Failed password for invalid user gil from 222.68.176.236 port 17916 ssh2
Apr 16 12:57:34 herolcb sshd[9929]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:35 herolcb sshd[9995]: Invalid user gilbert from 222.68.176.236
Apr 16 12:57:35 herolcb sshd[9996]: input_userauth_request: invalid user gilbert
Apr 16 12:57:35 herolcb sshd[9995]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:35 herolcb sshd[9995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:35 herolcb sshd[9995]: pam_succeed_if(sshd:auth): error retrieving information about user gilbert
Apr 16 12:57:36 herolcb sshd[9995]: Failed password for invalid user gilbert from 222.68.176.236 port 18128 ssh2
Apr 16 12:57:36 herolcb sshd[9996]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:36 herolcb sshd[9997]: Invalid user gillian from 222.68.176.236
Apr 16 12:57:36 herolcb sshd[9998]: input_userauth_request: invalid user gillian
Apr 16 12:57:36 herolcb sshd[9997]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:36 herolcb sshd[9997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:36 herolcb sshd[9997]: pam_succeed_if(sshd:auth): error retrieving information about user gillian
Apr 16 12:57:38 herolcb sshd[9997]: Failed password for invalid user gillian from 222.68.176.236 port 18311 ssh2
Apr 16 12:57:38 herolcb sshd[9998]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:38 herolcb sshd[9999]: Invalid user gina from 222.68.176.236
Apr 16 12:57:38 herolcb sshd[10000]: input_userauth_request: invalid user gina
Apr 16 12:57:38 herolcb sshd[9999]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:38 herolcb sshd[9999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:38 herolcb sshd[9999]: pam_succeed_if(sshd:auth): error retrieving information about user gina
Apr 16 12:57:41 herolcb sshd[9999]: Failed password for invalid user gina from 222.68.176.236 port 18524 ssh2
Apr 16 12:57:41 herolcb sshd[10000]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:41 herolcb sshd[10001]: Invalid user ginnie from 222.68.176.236
Apr 16 12:57:41 herolcb sshd[10002]: input_userauth_request: invalid user ginnie
Apr 16 12:57:41 herolcb sshd[10001]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:41 herolcb sshd[10001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:41 herolcb sshd[10001]: pam_succeed_if(sshd:auth): error retrieving information about user ginnie
Apr 16 12:57:43 herolcb sshd[10001]: Failed password for invalid user ginnie from 222.68.176.236 port 18810 ssh2
Apr 16 12:57:43 herolcb sshd[10002]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:44 herolcb sshd[10017]: Invalid user giovanni from 222.68.176.236
Apr 16 12:57:44 herolcb sshd[10018]: input_userauth_request: invalid user giovanni
Apr 16 12:57:44 herolcb sshd[10017]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:44 herolcb sshd[10017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:44 herolcb sshd[10017]: pam_succeed_if(sshd:auth): error retrieving information about user giovanni
Apr 16 12:57:46 herolcb sshd[10017]: Failed password for invalid user giovanni from 222.68.176.236 port 19063 ssh2
Apr 16 12:57:46 herolcb sshd[10018]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:47 herolcb sshd[10084]: Invalid user giselle from 222.68.176.236
Apr 16 12:57:47 herolcb sshd[10085]: input_userauth_request: invalid user giselle
Apr 16 12:57:47 herolcb sshd[10084]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:47 herolcb sshd[10084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:47 herolcb sshd[10084]: pam_succeed_if(sshd:auth): error retrieving information about user giselle
Apr 16 12:57:48 herolcb sshd[10084]: Failed password for invalid user giselle from 222.68.176.236 port 19362 ssh2
Apr 16 12:57:48 herolcb sshd[10085]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:48 herolcb sshd[10086]: Invalid user gladys from 222.68.176.236
Apr 16 12:57:48 herolcb sshd[10087]: input_userauth_request: invalid user gladys
Apr 16 12:57:48 herolcb sshd[10086]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:48 herolcb sshd[10086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:48 herolcb sshd[10086]: pam_succeed_if(sshd:auth): error retrieving information about user gladys
Apr 16 12:57:50 herolcb sshd[10086]: Failed password for invalid user gladys from 222.68.176.236 port 19533 ssh2
Apr 16 12:57:50 herolcb sshd[10087]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:50 herolcb sshd[10088]: Invalid user glen from 222.68.176.236
Apr 16 12:57:50 herolcb sshd[10089]: input_userauth_request: invalid user glen
Apr 16 12:57:50 herolcb sshd[10088]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:50 herolcb sshd[10088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:50 herolcb sshd[10088]: pam_succeed_if(sshd:auth): error retrieving information about user glen
Apr 16 12:57:53 herolcb sshd[10088]: Failed password for invalid user glen from 222.68.176.236 port 19748 ssh2
Apr 16 12:57:53 herolcb sshd[10089]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:53 herolcb sshd[10091]: Invalid user glenn from 222.68.176.236
Apr 16 12:57:53 herolcb sshd[10092]: input_userauth_request: invalid user glenn
Apr 16 12:57:53 herolcb sshd[10091]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:53 herolcb sshd[10091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:53 herolcb sshd[10091]: pam_succeed_if(sshd:auth): error retrieving information about user glenn
Apr 16 12:57:55 herolcb sshd[10091]: Failed password for invalid user glenn from 222.68.176.236 port 20034 ssh2
Apr 16 12:57:55 herolcb sshd[10092]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:56 herolcb sshd[10158]: Invalid user gloria from 222.68.176.236
Apr 16 12:57:56 herolcb sshd[10159]: input_userauth_request: invalid user gloria
Apr 16 12:57:56 herolcb sshd[10158]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:56 herolcb sshd[10158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:56 herolcb sshd[10158]: pam_succeed_if(sshd:auth): error retrieving information about user gloria
Apr 16 12:57:58 herolcb sshd[10158]: Failed password for invalid user gloria from 222.68.176.236 port 20289 ssh2
Apr 16 12:57:58 herolcb sshd[10159]: Received disconnect from 222.68.176.236: 11: Bye Bye
Apr 16 12:57:58 herolcb sshd[10160]: Invalid user goddard from 222.68.176.236
Apr 16 12:57:58 herolcb sshd[10161]: input_userauth_request: invalid user goddard
Apr 16 12:57:58 herolcb sshd[10160]: pam_unix(sshd:auth): check pass; user unknown
Apr 16 12:57:58 herolcb sshd[10160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.68.176.236
Apr 16 12:57:58 herolcb sshd[10160]: pam_succeed_if(sshd:auth): error retrieving information about user goddard

herolcb24

我暂时把sshd服务关了，/var/log下的secure日志不更新了。

cuci

暴力破解不怕，只要破不出来就行
你可以加key认证登录，就算破出来passwd拿不到key也无所谓

herolcb24

原帖由 cuci 于 2008-4-16 13:28 发表
暴力破解不怕，只要破不出来就行
你可以加key认证登录，就算破出来passwd拿不到key也无所谓

我查看了以前的secure日志，发现不止今天，很多天都有不同的ip做类似的事情。
他们用的什么工具，怎么找到我的？
怎么防止阿？破不了，可是日志被他们刷得看起来不爽阿。

herolcb24

我改了sshd_config的配置
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

请问这样之后，他们还能暴力ssh登入吗？
如果他们继续的话，secure日志会不会继续记录他们的行为？

yupp

做不做要看他们了，不过禁用密码登陆了，再暴力猜密码就没有意义了吧

cuci

这种行为哪里都有，没办法禁止

herolcb24

原帖由 cuci 于 2008-4-16 14:34 发表
这种行为哪里都有，没办法禁止

可是被他们这样刷日志，我觉得很烦啊。
是不是只能通过设置iptables规则，阻止他们访问sshd服务，这样就不会被刷日志了？

gucuiwen

把尝试登陆的间隔和静止登陆时间设置长一点，把尝试次数减少一点，这样尝试就少多了：
LoginGraceTime 10m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3

上面设置表示连续登陆三次失败后再次登陆要10分钟以后。

再加上key方式登陆，破解的可能就微乎其微了。日志也不会刷出那么多。